CVE-2026-31591: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish
In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish
Lock all vCPUs when synchronizing and encrypting VMSAs for SNP guests, as allowing userspace to manipulate and/or run a vCPU while its state is being synchronized would at best corrupt vCPU state, and at worst crash the host kernel.
Opportunistically assert that vcpu->mutex is held when synchronizing its VMSA (the SEV-ES path already locks vCPUs).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the kernel locks all vCPUs when synchronizing and encrypting VMSAs for SNP guests (i.e., enable the behavior that prevents userspace from manipulating or running a vCPU while its VMSA is being synchronized). Opportunistically assert that vcpu->mutex is held during VMSA synchronization.
Linux kernel (KVM SEV) lock_all_vcpus_when_synchronizing_VMSA = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31591?
CVE-2026-31591 is considered a medium severity vulnerability affecting KVM in the Linux kernel.
How do I fix CVE-2026-31591?
To fix CVE-2026-31591, update your Linux kernel to a version that includes the security patch addressing this vulnerability.
What types of systems are affected by CVE-2026-31591?
CVE-2026-31591 affects Linux kernel versions between 6.11 and 7.0.1 that utilize KVM/SEV for virtualization.
What impact does CVE-2026-31591 have on my system?
The impact of CVE-2026-31591 includes potential security risks when synchronizing VMSAs for SNP guests in virtual environments.
Is there a public exploit available for CVE-2026-31591?
As of now, there are no publicly known exploits specifically targeting CVE-2026-31591.